Anonymous: Fact vs. Fiction

By Josh Corman & Brian Martin

2011-12-28

The story of Anonymous is interesting. Some of the activities and exploits of the "group"
are surely entertaining. As such, the media tends to run wild and loose with fact, injecting
a healthy dose of fiction along the way. With as much truth as fiction in the news, it makes
it difficult to understand and accurately portray such a group. It skews our perception of
Anonymous' activities and goals. Reporting with a lack of information or perspective is often just
as big a disservice as reporting inaccurate information.

After our DEFCON 19 Panel "Whoever Fights Monsters...", we had several intense discussions with
many attendees and even some self-identifying members of Anonymous. While there were many take-aways,
our biggest was that one of the reasons our collective narrative is so far off base is due to a bit
of a Rorschach effect. We see in Anonymous, what we want to see. We project. Our narrative says more
about us than it does about them. Just because we may want them to be "demonstrating insecurity in
order to catalyze better security", doesn't mean that's what is driving them. In fact, there isn't
even one singular, monolithic motivation or cause - and that is one of the next points.

With that, we examine some of the myths and fiction surrounding Anonymous. Anonymous is surrounded
in contradictions and represents a paradox. Exploring the
paradox is part of the dialogue, as contradictions are inherent in the subject matter.

Fact or Fiction: Leadership and a Defined Group

Anonymous is a loose collective with no membership roster, not a monolithic group. One could say it is an "idea", but
even that is incorrect, as it is a collective of ideas. Without structure, without a roster, without
leadership, how can a collection of people even be called a group, let alone affect change? Despite that
they call themselves a group, and by definition they are one. They assemble under the banner and ideal of Anonymous.
What exactly that is, is hard to nail down. The
idea of such a nebulous group that can usually work together to achieve a goal is a foreign concept
to most people. For law enforcement, who is already struggling to break away from the mindset that
digital criminal organizations are like the Mafia, Anonymous represents an entirely new paradigm.

To add even more confusion, Anonymous may have equally undefined sub-groups; people who associate
with Anonymous, but only to participate in a specific cause or action. These pockets have
different backgrounds, different motivations, and different levels of involvement.
When people seem surprised that Anonymous did this or that - that it may be "out of character for them" - this
is often due to the fact that they assign a singular, cohesive persona and timeline to one group - when reality
is more of a morphing plurality of parties and interests. Commentary from the group mentions a
hive mind, or collective consciousness in
psychology. Using IRC and Twitter, the group gathers like-minded individuals for operations and they effectively
become a cell of the group.

Anonymous is less of a cohesive singular personality than it is a brand or a franchise - which can be borrowed by anyone - and
it has been. "Anonymous is not Unanimous". This introduces
complications for the group, when anyone can claim involvement and then tarnish the brand.
This can be used by a bored person or a more organized subversive group that seeks to undermine
Anonymous.

More importantly, there has been at least one splinter group, LulzSec, that formed from Anonymous. A month after splintering, LulzSec and
Anonymous announced that they "made up" so to speak, and fully support each other. With multiple
groups operating and focusing on different goals, while still not having a defined roster, the question
of membership becomes more important. This becomes evident when a journalist must qualify an
interview in the headline:
Our 'Possible' Interview with a Member of LulzSec. The first part of the article further
articulates the confusion:

DataDoctors First question: How do we know that this is really a LulzSec account and not a wanna be fan?

Lulzsec: We do not represent the twitter voice of LulzSec. We are the original founders.

Further updates to the article indicate LulzSec denied this person is legit, while the interviewee
insists they are part of a splinter group of LulzSec. Regardless, the one thing that is abundantly clear
is that leadership appears to be in short supply. Despite that, there is some sense of leadership,
as hundreds, if not thousands, of members can mobilize to achieve the same goal.
Temporary thought leaders can emerge on designated IRC channels. Anyone can take up this title by
being in channel and making an argument that people want to follow.

Fact or Fiction: Hacktivism is New

Digital or Internet activism is the use of
technology to facilitate a group of people to more effectively communicate over large distance in order
to effect some form of change. When one of the methods used to this end is hacking (generally accepted
as committing some form of computer crime), the term "hacktivism"
is used. Anonymous has used hacking as a vehicle to expose private information they felt should be public.

Hacktivism predates Anonymous by a decade a more. Perhaps the first documented instance comes from
1989, when a malicious worm called "WANK" was used to protest nuclear weapons.
According to Wikipedia's timeline of hacktivism, the first
incident of hacktivism not involving
self-replicating software was the "Intervasion of the UK orchestrated by a group called the Zippies on Guy Fawkes Day".
While unrelated to the group Anonymous, the coincidence of it occurring on Guy Fawkes Day is certainly interesting.

Not all hacktivism involves illegal activity. The legitimate use of technology to gain access
to information from diverse sources and piecing it together can often appear
to be the result of hacking. Using open-source intelligence (OSINT)
to piece together details, it is possible expose a wide range of information that may not have been thought of as public, despite
being available to anyone that looked for it. This activity historically took the form of "doxing" (document dropping),
an old practice of exposing detailed personal information about an individual such as name, phone number,
address, or relative names. Primarily used as a threat or indirect attack, exposing
a person conducting illegal hacking in such a way can assist law enforcement in apprehending the person.
However, by publishing information on people in sensitive positions (e.g., law enforcement that may be undercover) or persons wishing to stay out
of the spotlight (e.g., political donors), "doxing" can be used by activists in a similar manner.

Fact or Fiction: A Force for Good

A fundamental trait of many original Anonymous is their desire to do good. The group's actions are
born out of a sense of righting wrongs and combatting injustice. There is an ethical delimna
when achieving goals in pursuit of good require breaking the law, but it is one the group
sees as a necessary evil. Despite good intentions, some of the group's activities are
certainly questionable, while others are clearly misguided and do more harm than good.

In early December, 2011, Anonymous drew
criticism for "OpRobinHood", an operation intended to steal from the rich
and give to the poor. This idea was great in theory, but many suspected it would
end up hurting the common people, not banks or big corporations. This was put
to the test when credit
cards pilfered from the Stratfor hack were used to donate to several charities.
Instead of helping charities, the fraudulent
transactions are being returned. Not only did the money not end up helping
the charities, the misguided attempt to help ended up causing them administrative
overhead in trying to make things right. Worse, at least one charity
said they
are charged $35 for each fraudulent transaction and pleaded with Anonymous not to
make any more donations. The full story and operation have yet to play out, but early
signs show that things are more complex and cleanly 'good' in practice than in theory.

Ultimately, in attempting to help the poor and needy, Anonymous has hurt both
charities and common people. The credit cards taken from Stratfor were not corporate
cards tied to faceless businesses. They were mostly personal credit cards of average
citizens, including some
that had to close their accounts and did not have the money donated.
The banks will likely not absorb the cost of the fraudulent transactions. Rather,
they will pass the costs around to merchants in the form of additional fees.
This may in turn lead to an increased cost of service as merchants pass the costs down.
In the end, Anonymous may have robbed from the poor, not the rich.

Fact or Fiction: Anonymous and LulzSec Make you Vulnerable

The classic phrase, "don't shoot the messenger" must be remembered. While it takes a criminal to
break into your system and cause some form of mischief, that person
did not make your system vulnerable. They merely exploited the vulnerabilities that
were already present. Either through manufacturer defect or misconfiguration, the system has
weaknesses before the hacker attackers. The private information that is being exposed by
groups such as Anonymous and LulzSec was being stored on systems with inadequate protection.

Members of LulzSec have claimed their activity was based on showing that
the emperor has no clothes.
Subsequently, LulzSec believes they have revived the Antisec Movement,
focusing on general insecurity, where the original movement was based primarily on exposing problems
with security companies and professionals. Others following in the footsteps of LulzSec fomented the
Antisec Movement by attacking not only security companies, but any other company they found to be vulnerable.

"They don't need any additional pressure on them from a -- let's just call it what it is -- a terrorist organization." -- Jimmy Chavez

Noted privacy researcher and advocate Dissentonce commented,
"It was a Class C misdemeanor when an AZ state employee revealed PII that endangered others, but when @LulzSec did it, it's 'terrorism?'"
Chavez' labeling either group a "terrorist organization" is disingenuous and self-serving at
best, as Anonymous / LulzSec's activity certainly don't fit the
definition of terrorism.
Increasingly aggressive acts against policy makers and law enforcement will certainly invite
the term 'terrorist', even if it is misapplied.
In addition, given the diverse nature of the group, many members or people
that identify with Anonymous have morals that would preclude them from
staying involved if they thought they were close enough to even mistaken
for "terrorism".

Fact or Fiction: They Are Not Moral

Cries that Anonymous is not legitimate in the activism movement because of a supposed lack of morals
are shortsighted. It simply does not matter if you feel they are moral or not. Their
activities are not about your morals or values. Ethics are a secondary
thought at best; if Anonymous feels that a specific action will have the desired result,
they act based on their perception of the greater good. It is clear that to many involved,
the ends justify the means. In other cases, for some members of Anonymous, the real-world consequences
for their digital activity may not be fully realized.

As previously covered, the notion that such a group adheres to any one set of beliefs,
morals or code of ethics is wrong. With a large, nebulous, diverse group such as Anonymous,
we must also consider that decisions are unlikely to be made according to any one person's
sense of morality (more on this later), making it difficult to ascribe an ethical standard to the group as a whole.
There are simply too many factors at play and too many individuals affiliated with the group
to ascribe a binary value of "yes" or "no" to the question of Anonymous' morals.

Fact or Fiction: The Concept of "Organized Chaos" is Absurd

As people try to wrap their head around the concept of such a fundamentally different
group, conclusions are reached that seem contradictory. The idea that a group or idea
can be "organized chaos" appears to be an oxymoron, yet it certainly applies. The loose
structure, lack of central leadership, diverse objectives, and wide range of tools
at their disposal speak to this. They are certainly organized, as demonstrated by
the
BART protests. They are also most assuredly chaotic, practicing a form of
civil disorder that borders
on general chaos.

The concept that organization and logic can be found in chaotic situations has been
studied and falls under the category of a
complex adaptive system. Both
Murray Gell-Mann and Kevin Dooley
write about the topic as it applies to a variety of systems, including socially.
Dooley writes:

Contingency theory states that an organization structures itself and behaves in a
particular manner as an attempt to fit with its environment. Thus organizations are more
or less complex as a reaction to environmental complexity. An organization's
environment may be complex because it is turbulent, hostile, diverse, technologically
complex, or restrictive. An organization may also be complex as a result of the
complexity of its underlying technological core.

Applying this to Anonymous is fitting and revealing.

Fact or Fiction: They Believe in Anonymity

As their name suggests, the group certainly cherishes their own anonymity. With some
of their actions crossing moral and legal lines, anonymity becomes a protective blanket
to keep them running afoul of the law. However, there is a flip side; many affiliated with Anonymous
do not believe in the anonymity of the people they expose. This can be seen
in their
leaking of BART police information,
leaking Booz Allen email and logins, and
Arizona law enforcement information leak that included officer and confidential
informant information. During our feisty DEFCON Q&A, David Etue posed this to the Anons
participating in the exchange;

"There is something paradoxical about a group promotes transparency, but
isn't transparent themselves; and believes in anonymity, but negatively
impacts the anonymity of others. How do you resolve your values and operations?" -- David Etue

This is further exacerbated when Anonymous claims to fight for the people, yet performs
actions that directly hurt the common person. Leaking databases full of consumer information
surely teaches a company a lesson in security, but does so in a manner that yields a high
amount of collateral damage. Leaking the personal information about police officers
and their family makes a point, but does not fight corruption or the relatively small number
of "bad apples" in police departments. This not only belies a cognitive dissonance, but may also hint at the
presence of less noble/righteous participants - and even psychopathy within
the group.

Fact or Fiction: Anonymous Supports Free Speech & Civil Liberty

On the surface, this is most assuredly true. Looking deeper, there appears to be a
lack of understanding of causality that could drastically impact both free speech and
civil liberties. Legislators have a history of introducing new laws as part of a knee-jerk
reaction to a high profile negative incident. If Anonymous continues to
break the law to achieve their goals, they risk legislators replying the only way they
know how; more legislation. In doing so, the risk of sweeping laws being enacted that are poorly
considered is high. This could lead to new laws that limit free speech, suspend or
restrict civil liberty, and take away freedoms we currently enjoy.
As one of the authors remarked at DEFCON and elsewhere;

If Anonymous continues in the same fashion as they have for years, what will the group say
when a "Cyber Patriot Act" modeled after the Patriot Act
or "Cyber Neo-McCarthyism"
is enacted as a direct result of their actions?

Fact or Fiction: Disinformation Cuts Both Ways

With such a radical shift from a classic activist group, the level of inaccurate
or misleading information is immense. The disinformation we see about Anonymous
and their actions come from a variety of sources, including the media, analysts, law
enforcement, chaotic actors (that may or may not associate with the group) and Anonymous
themselves.

Law enforcement and media are consistently contributing to a campaign of disinformation,
often times without realizing it. As we see more frequent articles announcing the
"bust of # members of Anonymous", it gives the perception that law enforcement is making
steady progress fighting the group. In addition, it is easy to read into such articles
and believe that they are "key" or "core" members of the group. In reality, they may
be casual members, sympathizers or completely unaffiliated with the group. Regardless
of their affiliation, once the announcement is made, they are branded as such and the
world is rarely exposed to a correction or follow-up with details. The
articles that claim "Topiary of LulzSec busted" or "Commander X taken down" also
call into question the ratio of persons to handles. What if multiple people assume the
same name, just as they assume one name as a group?

There are an increasing number of people that consider themselves ex-Anonymous.
For a variety of reasons, they no longer identify themselves as part of the group.
For example, "SparkyBlaze" quit the group leaving a
missive behind focusing on Anonymous removing innocent peoples' right to stay
anonymous themselves. In a few cases, the persons will stay involved to some degree. For example,
Gregg Housh no longer identifies with the group, but calls himself an observer
of the group as he maintains a timeline
related to Anonymous. Another person that is involved, but from a slightly
removed stance, is St4rFox (Twitter feed now
gone), who has talked about his involvement in running a site to train would-be Anonymous
members on hacktivism and hacking, titled Operation NewBlood. Both of these individuals call to question
if they are part of the group as a fringe element, members of the group that
are attempting to manage public perception, or simply acting as sources of information and
disinformation as is convenient.

With dozens of Twitter feeds likely operated by twice as many people, the level
of accuracy and trustworthiness of the information being broadcast by Anonymous
is questionable. With so many sources of noise about the group, for example
Joseph Black and his creating confusion with wild
claims, it becomes hard to find the signal. Finally, there are an unknown number
of actors that are influencing, or attempting to influence, perception of
the group such as a supposed Federal Bureau of Investigation (FBI)
psychological profile of Anonymous that was later
determined to be fake. Additionally, private citizens, some with an
apparent motive to profit,
have been
attempting to infiltrate their ranks.

Anonymous: A Visit from Rorschach

This isn't a case of fact versus fiction, this is a simple truth about human
nature and perception. We project our own desires, fears and love on others, and Anonymous is no
different. Anonymous is a real Rorschach test, helping us discover what we see
in the group day to day. Yes, day to day because perception changes quickly, and
what we see in the group can change just as quickly. Early on, one author of this
article saw Anonymous as "light gray hats demonstrating insecurity to catalyze
security". Over time, that opinion changed as more activity occurred and Anonymous
matured.

Many sympathetic to Anonymous see them as a group of Robin Hoods, hitting the
rich and powerful in the name of the oppressed people. Some analysts see them more
as the Joker, a purely chaotic actor that wants to see the world burn. Others
romanticize the group, seeing the greater good they hope to accomplish, falling in
love with the anti-hero 'V'. This projection and perception says more about us
than it does about Anonymous. In short, we
see what we want to see in the group.

Copyright 2011-2012 by Josh Corman and Brian Martin. Permission is granted to quote, reprint or redistribute provided the
text is not altered, appropriate credit is given and a link to the original copy is included. Custom graphic
courtesy of Mar - sudux.com.

Should you feel generous, please donate a couple of bucks on our behalf to any 501(c)(3) non-profit that benefits animals or computer security.